File name: | DHL_119040 makbuz belgesi, pdf.iso |
Full analysis: | https://app.any.run/tasks/498ce0cb-5996-4b4e-a029-77c63f3d1446 |
Verdict: | Malicious activity |
Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
Analysis date: | July 17, 2019, 13:08:13 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-iso9660-image |
File info: | ISO 9660 CD-ROM filesystem data 'DHL_119040 makbuz belgesi, pdf' |
MD5: | 049B85A8DD55580BDC5147A1AC05C6A1 |
SHA1: | 1983915C947475BD5F099A4259BB0C5EEB420F90 |
SHA256: | 987B9071517B11F829ECCF126E96F104553D85F9D4B4A0058456DC2C86823CB1 |
SSDEEP: | 6144:VN8EypKp2ZMf4rowuz5pJbeypECUHLadFrnFkc6931x3x+jMOKtiqdXVvaDZbh:0jwj4UwujJf4HLaLrn693YjjK5d8Dv |
.atn | | | Photoshop Action (37.5) |
---|---|---|
.gmc | | | Game Music Creator Music (8.4) |
.abr | | | Adobe PhotoShop Brush (7.5) |
System: | Win32 |
---|---|
VolumeName: | DHL_119040 makbuz belgesi, pdf |
VolumeBlockCount: | 235 |
VolumeBlockSize: | 2048 |
RootDirectoryCreateDate: | 2019:07:17 10:42:02+01:00 |
Software: | PowerISO |
VolumeCreateDate: | 2019:07:17 10:42:02.00+01:00 |
VolumeModifyDate: | 2019:07:17 10:42:02.00+01:00 |
VolumeSize: | 470 kB |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3004 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\DHL_119040 makbuz belgesi, pdf.iso | C:\Windows\system32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3596 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DHL_119040 makbuz belgesi, pdf.iso" | C:\Program Files\WinRAR\WinRAR.exe | rundll32.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2880 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3596.44720\DHL_119040 makbuz belgesi, pdf.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3596.44720\DHL_119040 makbuz belgesi, pdf.exe | WinRAR.exe | |
User: admin Integrity Level: MEDIUM | ||||
2624 | "C:\Windows\System32\cscript.exe" //B //Nologo C:\Users\admin\App.vbs | C:\Windows\System32\cscript.exe | DHL_119040 makbuz belgesi, pdf.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2752 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | DHL_119040 makbuz belgesi, pdf.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
3128 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2328 | "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\gx0p4dqm.qeb" | c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe | RegAsm.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 | ||||
3452 | "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\kqs132ds.xcw" | c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe | RegAsm.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 |
(PID) Process: | — | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | — | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E |
Operation: | write | Name: | @C:\Windows\System32\isoburn.exe,-350 |
Value: Disc Image File | |||
(PID) Process: | — | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iso\OpenWithProgids |
Operation: | write | Name: | Windows.IsoFile |
Value: | |||
(PID) Process: | — | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
Operation: | write | Name: | LangID |
Value: 0904 | |||
(PID) Process: | — | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E |
Operation: | write | Name: | @%SystemRoot%\System32\isoburn.exe,-352 |
Value: Windows Disc Image Burner | |||
(PID) Process: | — | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
Operation: | write | Name: | C:\Windows\System32\isoburn.exe |
Value: Windows Disc Image Burner | |||
(PID) Process: | — | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
Operation: | write | Name: | C:\Program Files\WinRAR\WinRAR.exe |
Value: WinRAR archiver | |||
(PID) Process: | — | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
Operation: | write | Name: | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe |
Value: Adobe Acrobat Reader DC | |||
(PID) Process: | — | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
Operation: | write | Name: | C:\Windows\eHome\ehshell.exe |
Value: Windows Media Center | |||
(PID) Process: | — | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
Operation: | write | Name: | C:\Program Files\Internet Explorer\iexplore.exe |
Value: Internet Explorer |
PID | Process | Filename | Type | |
---|---|---|---|---|
2328 | vbc.exe | C:\Users\admin\AppData\Local\Temp\gx0p4dqm.qeb | — | |
MD5:— | SHA256:— | |||
2624 | cscript.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.Lnk | lnk | |
MD5:D3E368FD30E5A762C36C04255088F9F8 | SHA256:32AB2F994C0DB9DA2BA1022A0A9310CAB9F852B3891C940FF4B226C17D854D69 | |||
2880 | DHL_119040 makbuz belgesi, pdf.exe | C:\Users\admin\App.vbs | text | |
MD5:29D78326650B22607D2011633F648646 | SHA256:35A83EB141B87127A5E2E9C56FDA2A35736112E3C7EAFD05745E5CA7387B8C25 | |||
2752 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dat | binary | |
MD5:A9B42841DC328EB70ED3E5ECCCCEA0B4 | SHA256:D29ED77B5D14C5E3E71CF6B24CBA79E6882851F017EAAD949E9665507BAB69C1 | |||
2752 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.dat | bs | |
MD5:0A9C5EAE8756D6FC90F59D8D71A79E1E | SHA256:B1921EA14C66927397BAF3FA456C22B93C30C3DE23546087C0B18551CE5001C5 | |||
3596 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3596.44720\DHL_119040 makbuz belgesi, pdf.exe | executable | |
MD5:BD6166B83F1539B0BD8268526ADDC5BA | SHA256:643AD605C480DB8B739E32B5E56E27B744B0EA93A8740C5170A84D33B6F4D7DB | |||
2880 | DHL_119040 makbuz belgesi, pdf.exe | C:\Users\admin\AppData\Roaming\pdf.exe | executable | |
MD5:BD6166B83F1539B0BD8268526ADDC5BA | SHA256:643AD605C480DB8B739E32B5E56E27B744B0EA93A8740C5170A84D33B6F4D7DB | |||
2752 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.bin | binary | |
MD5:4E5E92E2369688041CC82EF9650EDED2 | SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48 | |||
2752 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.dat | binary | |
MD5:4D784935677AE26ACDC3FB84FA1E6CF8 | SHA256:C77E2D82DB9066E4DBFDE3AE0461A4259505F435EC0DB2CE3BD005BE0E2DE67C | |||
2752 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exe | executable | |
MD5:278EDBD499374BF73621F8C1F969D894 | SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2752 | RegAsm.exe | 8.8.8.8:53 | — | Google Inc. | US | whitelisted |
2752 | RegAsm.exe | 204.152.219.70:3371 | abundantgrace1.ddns.net | QuadraNet, Inc | US | malicious |
Domain | IP | Reputation |
---|---|---|
abundantgrace1.ddns.net |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2752 | RegAsm.exe | A Network Trojan was detected | ET TROJAN Possible NanoCore C2 60B |
2752 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2752 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2752 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2752 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2752 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2752 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2752 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2752 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2752 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |